Create Table Based on Findings?

dninccno — Wed, 28 Sep 2022 18:04:31 GMT

We have AV logs that send the detection and the block separately. I'm trying to create a query where I can take each incident_id (which has a log with a block, and a log with a detection) and have the query verify that both of logs are there.

So it would table like incident_id ifDetectionFound ifBlockFound.

I can't seem to wrap my mind around how to have it search the logs again for a block. Right now I'm just indexing for action=block OR action=Detection, but it still requires me to compare incident_ids (which are quite long random bits of numbers)

Re: Create Table Based on Findings

ITWhisperer — Wed, 28 Sep 2022 13:49:30 GMT

| eval ifDetectionFound=if(action="Detection",action,null()) | eval ifBlockFound=if(action="Block",action,null()) | stats values(ifDetectionFound) as ifDetectionFound values(ifBlockFound) as ifBlockFound by incident_id

topic Create Table Based on Findings? in Getting Data In

Create Table Based on Findings?

Re: Create Table Based on Findings